I have windows 7 Home Edition 64 bit with Media Center, etc. Lately I have been converting some videos to h.264 mp4 and noticed something strange. Some of my mp4 files that played fine previously suddenly stopped playing. After checking things out I noticed that the ones that stopped playing have recent modified dates and are all over 4GB. I think some background process is adding metadata of some kind and corrupting the ones over 4GB. The modified dates seems to be like every 20-30 minutes one file to the next. The mp4 files below 4GB are still fine (even though they have more recent modified dates). The ones over 4GB are all trash now. I did recently back these up and move them to a new folder watched by media center. I also may have played them in media player. Anybody know of any process that automatically modifies mp4 files?
Restart and press f8 continuously and login to
safe mode with networking.. even within this mode, If u cant download use another pc and download and transfer this....
Use one scanner at a time
Download hitman pro 3.7 and have a full system scan.. http://www.surfright.nl/en
And/or
use malwarebyte and have a full system scan..http://www.malwarebytes.org/
And/or
use adwcleanerand have a full system scan..
http://www.bleepingcomputer.com/download/adwcleaner/)
And/or
use TDSS Killer have a full system scan..:
http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller
additional info
If everything fails, you can use offline bootable resccue cd and do a full system scan...
https://support.kaspersky.com/viruses/rescuedisk
http://windows.microsoft.com/en-us/windows/windows-defender-offline-faq
This may be a kind of encryption by a malware.. it will be difficulty to recover existing encrypted data other than a carryout a system restore to a previous date, where infection was not there
- Proposed as answer by Hetti Arachchige V Aravinda Wednesday, August 14, 2013 6:00 AM
- Unproposed as answer by flagrantHippo Saturday, August 17, 2013 3:24 AM
- Edited by Hetti Arachchige V Aravinda Wednesday, March 12, 2014 5:26 AM
Restart and press f8 continuously and login to
safe mode with networking.. even within this mode, If u cant download use another pc and download and transfer this....
Use one scanner at a time
Download hitman pro 3.7 and have a full system scan.. http://www.surfright.nl/en
And/or
use malwarebyte and have a full system scan..http://www.malwarebytes.org/
And/or
use adwcleanerand have a full system scan..
http://www.bleepingcomputer.com/download/adwcleaner/)
And/or
use TDSS Killer have a full system scan..:
http://www.bleepingcomputer.com/virus-removal/remove-tdss-tdl3-alureon-rootkit-using-tdsskiller
additional info
If everything fails, you can use offline bootable resccue cd and do a full system scan...
https://support.kaspersky.com/viruses/rescuedisk
http://windows.microsoft.com/en-us/windows/windows-defender-offline-faq
This may be a kind of encryption by a malware.. it will be difficulty to recover existing encrypted data other than a carryout a system restore to a previous date, where infection was not there
- Proposed as answer by Hetti Arachchige V Aravinda Wednesday, August 14, 2013 6:00 AM
- Unproposed as answer by flagrantHippo Saturday, August 17, 2013 3:24 AM
- Edited by Hetti Arachchige V Aravinda Wednesday, March 12, 2014 5:26 AM
Hi,
What software you are using to edit MP4 files?
To verify if the issue is related to the MP4 files, play the files with other media players and see if the issue persists.
Here is another article which discuss the similar issue:
Can a MP4 AVC H.264 greater than 4GB ?
http://forum.doom9.org/showthread.php?t=142605
Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
If any progress, please feel free to let me know.
Thanks.
I figured out how to repair the video files. Figured I'd post in case this happens to someone else
1. using a hex editor Find the "Xtra" atom (search for characters Xtra). Move to 4 bytes before this to get size of this atom and mark the Starting CUT Position. I see 00 00 00 A3 which in decimal is 163. We have to remove the 163 byte Xtra atom which includes the 4 byte size before it's 4 byte Xtra name. So from Starting CUT Postion move out to the byte just before the 4 bytes size before the "mdat" atom. For large files the size before the mdat atom will be 00 00 00 01 becuase it's size is over 4GB. This marks the ending CUT POSTION. If you count all the bytes you are about to cut, this should amount to 163 the size of the Xtra atom.
Within the Xtra atom we can see the following attributes that where added by windows thus corrupting the file.
WM/EncodingTime
WM/MediaClassSecondaryID
WM/MediaClassPrimaryID
2. Next we need to correct the size of the parent udta atom. Look at the 4 bytes before the udta atom. I see (00 00 01 03) hex which in decimal is 259. Subtract the size of the Xtra atom we just removed 163 giving 96 (00 00 00 60) hex . Paste the 60 hex in the 4 bytes before the udta atom.
3. Finally we need to correct the size of the parent moov atom. The 4 bytes before the moov atom are (00 AF E4 1B) hex which is 11527195.
11527195 - 163 = 11527032 (00 AF E3 78)
I still don't know what wrote the Xtra atom but I assume what ever wrote it used windows API's to write the WM attributes and corrupt the mp4 file. From now on I will try to set my mp4 files as read only.
- Proposed as answer by Hetti Arachchige V Aravinda Saturday, August 17, 2013 3:26 AM
- Marked as answer by flagrantHippo Saturday, August 17, 2013 4:24 PM
I figured out how to repair the video files. Figured I'd post in case this happens to someone else
1. using a hex editor Find the "Xtra" atom (search for characters Xtra). Move to 4 bytes before this to get size of this atom and mark the Starting CUT Position. I see 00 00 00 A3 which in decimal is 163. We have to remove the 163 byte Xtra atom which includes the 4 byte size before it's 4 byte Xtra name. So from Starting CUT Postion move out to the byte just before the 4 bytes size before the "mdat" atom. For large files the size before the mdat atom will be 00 00 00 01 becuase it's size is over 4GB. This marks the ending CUT POSTION. If you count all the bytes you are about to cut, this should amount to 163 the size of the Xtra atom.
Within the Xtra atom we can see the following attributes that where added by windows thus corrupting the file.
WM/EncodingTime
WM/MediaClassSecondaryID
WM/MediaClassPrimaryID
2. Next we need to correct the size of the parent udta atom. Look at the 4 bytes before the udta atom. I see (00 00 01 03) hex which in decimal is 259. Subtract the size of the Xtra atom we just removed 163 giving 96 (00 00 00 60) hex . Paste the 60 hex in the 4 bytes before the udta atom.
3. Finally we need to correct the size of the parent moov atom. The 4 bytes before the moov atom are (00 AF E4 1B) hex which is 11527195.
11527195 - 163 = 11527032 (00 AF E3 78)
I still don't know what wrote the Xtra atom but I assume what ever wrote it used windows API's to write the WM attributes and corrupt the mp4 file. From now on I will try to set my mp4 files as read only.
- Proposed as answer by Hetti Arachchige V Aravinda Saturday, August 17, 2013 3:26 AM
- Marked as answer by flagrantHippo Saturday, August 17, 2013 4:24 PM
It is wmpnetwk.exe (Windows Media Player Network Sharing Service) writing and corrupting our files. It adds 2 "tags" to the UDTA box in the file.
It does it whenever you do something to the MP4 file in explorer, in my case it was renamng the files that caused WMP to rewrite them. WTF? Who needs malware when you have WMP.
I wrote a C# script that removes the WMP tags from the MP4 files, making them playable again:
You can either compile as an exe or run it with cscs.exe.
- Edited by Mnerec Sunday, August 31, 2014 7:37 PM
It is wmpnetwk.exe (Windows Media Player Network Sharing Service) writing and corrupting our files. It adds 2 "tags" to the UDTA box in the file.
It does it whenever you do something to the MP4 file in explorer, in my case it was renamng the files that caused WMP to rewrite them. WTF? Who needs malware when you have WMP.
I wrote a C# script that removes the WMP tags from the MP4 files, making them playable again:
You can either compile as an exe or run it with cscs.exe.
- Edited by Mnerec Sunday, August 31, 2014 7:37 PM
Mnerec,
Do you know why this is causing the issue? It seems the moov size covers the xtra atom and its componets.
I had been doing this manually with AtomicParsley and HxD but I'm glad you have a script for us. I did try it and its not correcting the moov size for me but I'll see if I can figure it out in the code.
Thank you
- TT
Happy to hear you discovered a reason behind this. I went through a similar process with Microsoft support 2 years ago when I discovered Windows Live Photo Gallery was corrupting mp4s when any tag was added. I could always replicate and send through the different files as evidence but nothing was ever resolved. Funny how they can never replicate these things.
It was very inconsistent as to when it would happen, and it luckily hasn't been worring me for a while - mostly working around it, and lo-and-behold, i just discovered a large number of recently imported mp4s have become corrupt as soon as an image program (lightroom, picasa, etc) alters their tags. I have tested this again and I can confirm the alteration of the file through the addition of a metatag is causing the corruption.
I noticed that these are all mp4s from phones (HTC One 7 and Samsung Galaxy tab edge in this case). It is very inconsistent as I have others that were imported by lightroom several months ago and are fine. Same as I discovered a couple of years ago.
Mnerec, signed up to Technet specially to thank you for this - you just saved a bunch of very important family videos for us and cleared up the mystery as to what the heck was going on. I did all the virus, malware and rootkit scans, I did all the SMART tests, I nearly went out and bought a new hard drive thinking it must be corrupt - not to mention that these really precious family videos (first week of baby's life, that sort of irreplaceable thing) had been backed up, but backed up in an ALREADY CORRUPTED state, since the problem went unnoticed until much later. I had already tried some (hideously expensive) commercial solutions that seemed to see recoverable data in the files, but I was sure there must be a simpler explanation - WHY was it only happening to mp4 videos, for one thing!
Finally came across this discussion - the phone is also a HTC One - or One S, I think, and the symptoms were identical - moving the files or renaming them in Explorer caused them to stop working and for major panic to ensue.
I compiled your script and ran it on a copy of the data (a batch of 20-30 mp4 files) and hey presto the files play again - though not in WMP (tragically), but in VLC they work fine. Needless to say I have disabled wmpnetwk.exe.
I anticipate that this problem will be resolved in Windows 15 or so - we'll look forward to that, in the meantime, thank you once again!
Mnerec, signed up to Technet specially to thank you for this - you just saved a bunch of very important family videos for us and cleared up the mystery as to what the heck was going on. I did all the virus, malware and rootkit scans, I did all the SMART tests, I nearly went out and bought a new hard drive thinking it must be corrupt - not to mention that these really precious family videos (first week of baby's life, that sort of irreplaceable thing) had been backed up, but backed up in an ALREADY CORRUPTED state, since the problem went unnoticed until much later. I had already tried some (hideously expensive) commercial solutions that seemed to see recoverable data in the files, but I was sure there must be a simpler explanation - WHY was it only happening to mp4 videos, for one thing!
Finally came across this discussion - the phone is also a HTC One - or One S, I think, and the symptoms were identical - moving the files or renaming them in Explorer caused them to stop working and for major panic to ensue.
I compiled your script and ran it on a copy of the data (a batch of 20-30 mp4 files) and hey presto the files play again - though not in WMP (tragically), but in VLC they work fine. Needless to say I have disabled wmpnetwk.exe.
I anticipate that this problem will be resolved in Windows 15 or so - we'll look forward to that, in the meantime, thank you once again!
P.S. Unfortunately damage seems to have been done by wmpnetwk.exe in terms of removing metadata - I am not really clued up on what kinds of metadata are supposed to be in there but information like creation date (important for family videos, right?) has gone, even before running this script. Also a lot of the vids recorded in landscape now play sideways, am pretty sure they didn't before - wonder if that is down to missing metadata too?
- Edited by markowe Saturday, February 07, 2015 1:05 PM Added note about metadata
I did it exactly as described, but no luck for me (maybe because I have another atom 'free' before 'mdat' in my video file). So I fiddled with several variants of removing tags, and the one which eventually worked for me was crudely removing the whole atom
'udta' (with the preceding 4 bytes) all the way to the begining of atom free (4 bytes before occurence of the label). I did not update the size of the atom 'moov' as described above, and yet the file now plays in VPL. Thank you for directing my effort. Otherwise
I would be totally lost, or correcting it with expensive software which still does it crudely out of sync and with kind of random length.
BTW, my mp4 files got corrupted in Windows 7 Professional Edition when I was simply moving them from one directory to another on the same hard disk! Unbelievable.
This topic is archived. No further replies will be accepted.
Other recent topics
